← All articlesPRACTICAL KNOWLEDGE

Analysing legacy systems with AI without false confidence

AI accelerates understanding of code, data models, interfaces and documents. It does not replace executable behaviour, production telemetry or experienced domain knowledge. The article provides a controlled method, a realistic CTPM practice example and a concrete transfer artefact.

Realistic enterprise scene illustrating Analysing legacy systems with AI without false confidence
Short answer

AI accelerates understanding of code, data models, interfaces and documents. It does not replace executable behaviour, production telemetry or experienced domain knowledge.

What the concept actually means

Legacy analysis starts with inventory and hypotheses. AI explains fragments, generates search terms and connects clues; every claim is checked against code, data, tests or operations.

Why it matters in the enterprise

Confidence comes from triangulation: static analysis, runtime observation, data profiling, interviews and historical documents provide different perspectives.

A controlled method

The CTPM practice framework for controllable AI applications uses seven stages: understand the task, clarify context and data, apply AI deliberately, review professionally, handle deviations, approve accountably and document transfer. It is a transparent working framework, not a certification.

  • Define task and impact
  • Clarify data, context and permissions
  • Review against domain criteria
  • Control deviations, approval and evidence

CTPM practice example

CTPM practice example: Packages, table access and scheduler jobs are inventoried for a PL/SQL system. AI proposes dependency hypotheses; SQL queries, execution paths and developer review confirm or reject them.

Quality and test criteria

The following criteria make quality observable for this use case:

  • Claims link to verifiable artefacts.
  • Static and dynamic evidence remain distinct.
  • Unknowns are explicitly retained as unknowns.
  • Modernisation steps include rollback options.

Risks and common misconceptions

Risks include invented dependencies, missing dynamic SQL paths, confusing dead code with production logic and premature target architecture.

Example transfer artefact

Transfer artefact: an analysis and modernisation plan with system map, evidence, uncertainties, test safety net and prioritised changes.

Sources and references

  1. NIST: Secure Software Development Framework (SSDF) Version 1.1 (2022)
  2. NIST: Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence Profile (2024)
  3. ISO/IEC/IEEE: 29119 Software Testing (2022)